# Window.opener fix bypass

Phabricator's rel=noreferrer tabnabbing fix was bypassed with a line break in link syntax, letting attacker pages access window.opener and redirect the parent tab.

- Payout: $300
- Severity: low
- Program: Phabricator
- Credited: mishre
- Disclosed: 2018-02-18
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/317243
- Library page: https://bugbountylibrary.com/r/h1%3A317243
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:low technique:incomplete-fix technique:parser-differential vuln:misconfiguration vuln:open-redirect

**Target:** Phabricator document/wiki link renderer
**Root cause:** The fix that adds rel="noreferrer" to external links failed to normalize URLs containing line breaks, so a link like `[[ /\n/google.com | aaa ]]` was rendered without the protective rel attribute.
**Steps:**
1. Create a new Phabricator document.
2. Paste `[[ //google.com | aaa ]]` and preview; confirm rel="noreferrer" is added in DOM.
3. Replace with `[[ /\n/google.com | aaa ]]` (line break after slash).
4. Preview and observe no rel attribute is added.
5. Share document; victim clicking link opens attacker page that reads window.opener and redirects parent tab.
**How found:** Researcher knew the prior tabnabbing fix added rel=noreferrer, tested link syntax variants, and found a line break in the URL prevented the attribute from being added.
**Exploitation:** Attacker hosts a page with `window.opener.location.replace('http://example.com')`, embeds it as a link in a shared Phabricator document using the line-break bypass so no rel=noreferrer is applied, and when a victim clicks it the new window controls the parent tab for phishing.
**Insight:** When a security fix adds an attribute based on URL parsing, fuzz the link syntax with whitespace/newlines and control characters to find inputs the parser treats as external but the fix's matcher does not.